PowerShell Get-Process LSASS Access

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects the use of PowerShell's `Get-Process` cmdlet or its aliases (`ps`, `gps`) specifically targeting the `lsass` process. Accessing the `lsass` process memory is a common technique used by attackers to dump credentials, making this activity highly suspicious and indicative of potential credential theft.